使用JavaScript将密码随机盐化并从C＃进行验证

Question

I want to make password maintain process strong for an asp.net web application. Please validate my idea if it is workable. If yes then please suggest sample code or links to implement. Otherwise suggest how can I send password securely from browser to server and store in hash.

Note: I am using TLS (SSL) already for security.

Steps:

1. While registering user, hash user password with random salt from JavaScript in Client browser.
2. Submit form.
3. Server side code will store the hash in database.
4. When user try to login, hash user password with random salt from JavaScript in Client browser.
5. Submit form.
6. Validate database stored hash with login password hash. (I am thinking both hash will be different due to random salt but verification function will be able to compare it)

Answer 1

This is not secure. The hashing and salting should be a hidden implementation secret that the server provides, not the client. Since the client has the implementation secret, should someone gain access to your database, they can reverse engineer your security model.

HTTPS would protect the password in transit. I would also avoid rolling your own authentication system as there are many "gotchas". ASP.NET both Framework and Core provide strong patterns and implementations for authentication.